CVE-2021-24581

HIGH

Blue Admin WordPress Plugin < 21.06.01 - Stored XSS and CSRF via Logo Title

Title source: llm
STIX 2.1

Exploitation Summary

EIP tracks 1 public exploit for CVE-2021-24581. PoCs published by Abisheik M.

AI-analyzed exploit summary This is a functional CSRF exploit targeting WordPress Plugin Blue Admin versions <= 21.06.01. It demonstrates how an attacker can trick an authenticated admin into submitting a malicious form, leading to stored XSS via the 'logo_text' parameter.

Description

The Blue Admin WordPress plugin through 21.06.01 does not sanitise or escape its "Logo Title" setting before outputting in a page, leading to a Stored Cross-Site Scripting issue. Furthermore, the plugin does not have CSRF check in place when saving its settings, allowing the issue to be exploited via a CSRF attack.

Exploits (1)

exploitdb WORKING POC
by Abisheik M · htmlwebappsphp
https://www.exploit-db.com/exploits/50925

This is a functional CSRF exploit targeting WordPress Plugin Blue Admin versions <= 21.06.01. It demonstrates how an attacker can trick an authenticated admin into submitting a malicious form, leading to stored XSS via the 'logo_text' parameter.

Classification
Working Poc 95%
Attack Type
Xss
Complexity
Trivial
Reliability
Reliable
Target: WordPress Plugin Blue Admin <= 21.06.01
Auth required
Prerequisites: Victim must be authenticated as admin · Victim must visit attacker-controlled page
devstral-2 · analyzed Feb 16, 2026 Full analysis →

References (1)

Core 1
Core References
Exploit, Third Party Advisory x_refsource_misc
https://wpscan.com/vulnerability/75abd073-b45f-4fe6-8501-7a6d0163f78d

Scores

CVSS v3 8.8
EPSS 0.0174
EPSS Percentile 83.0%
Attack Vector NETWORK
CVSS:3.1/AV:N/AC:L/PR:N/UI:R/S:U/C:H/I:H/A:H

Details

CWE
CWE-352 CWE-79
Status published
Products (1)
blue-admin_project/blue-admin < 21.06.01
Published Aug 30, 2021
Tracked Since Feb 18, 2026